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The eavesdropping scheme proposed by Wojcik [Phys. Rev. Lett. 90,157901(2003)] on 
the ping-pong protocol [Phys. Rev. Lett. 89, 187902(2002)] is improved by constituting 
a new set of attack operations. The improved scheme has a zero eavesdropping-induced 
channel loss and produces perfect anticorrelation. Therefore, the eavesdropper Eve 
can safely attack all the transmitted bits and the eavesdropping information gain can 
always exceed the legitimate user's information gain in the whole domain of the quantum 
channel transmission efficiency ry, i.e., [0,100%]. This means that the ping-pong proto- 
col can be completely eavesdropped in its original version. But the improvement of the 
ping-pong protocol security produced by Wojcik is also suitable for our eavesdropping attack. 

PACS number(s): 03.67.Hk, 03.65.Ud 

The private key bits can be produced between two remote parties by use of quantum key distribu- 
tion (QKD). QKD is a provably secure protocol since the security of QKD is based on fundamental 
laws of quantum physics. Many theoretical research works [2-20] have been focused on QKD since 
the pioneering work of Bennett and Brassard published in 1984 [1]. These QKD protocols are 
non-deterministic since the sender cannot determine the bit value that receiver will finally decode. 
Different from this kind of non-deterministic QKDs, the deterministic secure direct communication 
protocol is to transmit directly the secret messages without first generating QKD to encrypt them. 
This makes it very useful and usually desired, especially in some urgent time. However, the de- 
terministic secure direct communication is more demanding on the security than non-deterministic 
QKDs. Therefore, only recently a few of deterministic secure direct protocols are proposed [21-24]. 
One of them is the famous Bostrom-Felbinger protocol, or ping-pong protocol [22], which allows 
the generation of a deterministic key or even direct secret communication. 

In ping-pong protocol[22,25], Bob prepares two photons in the entangled state = (|0)|1) + 
|1)|0))/V2. He stor es one photon (home photon) in his lab and sends Alice the other one (travel 
photon) via a quantum channel. After receiving the travel photon Alice randomly switches between 
the control mode and the message mode. In the control mode Alice measures the polarization of 
the travel photon first in the z-basis and then announces publicly the measurement result. After 
knowing Alice's announcement Bob also switches to the control mode to measure the home photon 
in the same basis as that Alice used. Then he compares both measurement results. They should 
be perfectly anticorrelated in the absence of Eve. Therefore, the appearance of identical results is 
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considered to be the evidence of eavesdropping, and if it occurs the transmission is aborted. In the 
other case, the transmission continues. In the message mode, Alice performs the Z{ (j e {0, 1}) 
operation on the travel photon to encode j and sends it back to Bob, where Z = |0)(0| — 
After receiving the travel photon Bob measures the state of both photons in the Bell basis to decode 
the j = 0(1) corresponding to the |* + ) (l^ - )) result. 

The ping-pong protocol has been claimed to be secure and experimentally feasible[22]. However, 
since there is a separation of the verification procedure and the key generation in the ping-pong 
protocol, Wojcik has presented an undetectable eavesdropping scheme on the Bostrom-Felbinger 
protocol[25]. His eavesdropping attack produces the eavesdropping-induced channel loss, therefore, 
requires a lossy channel to work, otherwise the eavesdropper can be detected by observing the 
eavesdropping-induced channel loss. Wojcik's eavesdropping scheme produces the eavesdropping- 
induced channel loss at the level of 50% and the anticorrelation of the state of the home photon 
(kept by Bob, the legitimate receiver of secret messages) with that of the travel photon (sent by Bob 
to Alice, the sender of secret messages). If the transmission efficiency r\ of the quantum channel is 
not taken into account, the probability of the eavesdropper (i.e., Eve) being detected is zero due to 
the anticorrelation. However, in the case of the considerable quantum channel losses, it is possible 
for legitimate users to detect the eavesdropping by observing the quantum channel losses. That is, 
although Eve can attack all the transmitted bits and the eavesdropping-induced channel loss can be 
hidden in the channel losses when rj < 50%, if she attacks all the transmitted bits when 77 > 50%, 
then the eavesdropping-induced channel loss is greater than the channel losses and accordingly the 
legitimate users can find Eve in the line by observing the channel losses. 

Since Wojcik's eavesdropping scheme produces the eavesdropping-induced channel loss at the 
level of 50%, it is desirable to have an eavesdropping scheme on the ping-pong protocol without 
eavesdropping-induced channel loss. To construct his attacking protocol[25], Wojcik lets Eve use 
both the unitary operation and the auxiliary system, since Eve is limited only by the laws of 
quantum mechanics, but not at all by current technology [2], she is free to use any unitary oper- 
ation. In this paper, we will improve the Wojcik's eavesdropping scheme [25] by using the same 
auxiliary system but different set of attack operations. Our improved eavesdropping scheme indeed 
produces zero eavesdropping-induced channel loss and never produces both identical results of the 
measurements performed by Bob and Alice in the control mode. 

Obviously, Eve has no access to the home photon but can manipulate the travel photon while 
it goes from Bob to Alice and back from Alice to Bob. Eve uses two auxiliary spatial modes x, y. 
She prepares a photon in the state |0) and lets the other one be an empty mode, e.g., in the state 
Ivac^lO)^. Accordingly, the state of the whole system including the entangled photon pair is 

\initial) = |* + )/ lt |vac) a; |0) !y . (1) 

which is the same as Wojcik's. When Bob sends the travel photon to Alice, Eve attacks the quantum 
channel by manipulating the travel photon through a unitary operation (referred as to be the B — A 
attack hereafter) as follow, 



^Vtxy — UtxyVtxyQtxyi 



(2) 
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where 

Utxy = \0)(0\ v ® SWAP te + (Xy - \0)(0\ v ) <8> Xtx, (3) 

V tx y = \l)(l\y ® SWAP^ + (ly - \l)(l\y)®I tx , (4) 

X is an identity operator, and Q txy is denned in [25] as 

Q txy = SWAP te CPBS te2/ ^, (5) 

which is composed of the Hadamard gate, the SWAP gate, and the three-mode gate which is called 
the controlled polarizing beam splitter (CPBS) by Wqjcik. When acting on the initial state, the 
B — A attack transforms the whole system to the state \B — A) = W txy \initial} of the form 

\B - A) = ^\0) h \l) t (\vac) x \0) y + \l) x \vac) y ) + ^\l) h \0) t (\vac) x \l) y + \0) x \vac) y ). (6) 

Suppose that Alice now switches to the control mode and measures the state of the mode t. 
According to equation (6), we can see that after the B-A attack Alice will detect with 100% certainty 
a photon whose state is perfectly anticorrelated with the state of the home photon. Therefore, the 
probability of eavesdropping detection based on the correlation observation equals zero. This point 
is completely same as that in Ref.[25]. Moreover, from equation (6) we can also see that the 
B — A attack in the present eavesdropping scheme produces zero eavesdropping-induced channel 
loss. In contrast, the eavesdropping-induced channel losses in [25] arrives at 50%. This implies 
that, comparing to the Wojcik's eavesdropping scheme, in the present eavesdropping scheme, the 
domain in which Eve can attack all the transmitted bits is enlarged to [0, 100%] from the [0, 50%] in 
Rcf. [25]. Nonetheless, this does not certainly mean that the insecurity upper bound of transmission 
efficiency presented by Wojcik can be pushed up, for now we still do not know the variation of the 
eavesdropping (legitimate) information gain. Let us now analyze the performance of the scheme 
in the case of Alice operating in the message mode. After Alice performs the operation and 
sends the travel photon back to Bob, Eve performs her second attack (named as the A — B attack 
hereafter) on the travel photon. The A — B attack consists of the unitary operation W t ~*. After 
the A — B attack, the corresponding state of the whole system is 

\A B)j = l[(-l) j (Kt + + (*tt ~ n t )\0)y]\vac) x , (7) 

which is little different from the corresponding state in [25] due to the existence of the partial phase 
factor (-l)J'. 

The final step of the eavesdropping scheme is a measurement of polarization performed on the 
y photon. The measurement result is denoted as k, while Bob's Bell-state measurement on both 
photons is denoted as m = 0(1) corresponding to the \'& + )ht(\ 1 &~)ht) state. Assuming that Alice 
sends both values of j with the same probability, then the only nonzero probabilities Pjkm of possible 
measurement outputs are 



Pooo = 1 A Pwo = Pioi = Pi 10 = Pm = 1/8. 



(8) 
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which is the same as Wojcik's. Therefore, the quantum bit error rate induced by the eavesdropping 
in the present eavesdropping scheme is also at the same level of 1/4 as that in Ref.[25]. And the 
mutual information between any two parties can be easily worked out, 

3 4 

Iae = Iab = j log 2 - w 0.311 
Ibe = 1 - | log 2 3 + | log 2 5 « 0.074. (9) 

The same as Wojcik's eavesdropping scheme, the present scheme is also not symmetric. If after 
the A — B attack Eve performs with the probability of 1/2 an additional unitary operation St y — 
X t ZtCNOTtyX t Zt, where X t is an negation, then the asymmetry can be removed. If the present 
Sty is performed, then the state of the whole system evolves to 

\A B)f = S ty \A B)j = ![(*+ + *n)\j) v + - *te)\l) v ]\vac) x . (10) 

Note that the present operation St y is different from that in [25]. According to the viewpoint in 
Rcf. [25], that is, since Eve knows exactly when each of the St y operations has been performed, the 
symmetrization procedure does not reduce the mutual information between Alice and Eve while it 
disturbs the communication between Alice and Eve in such a way the mutual information between 
Alice and Bob is reduced. In the present scheme after the symmetrization procedure the mutual 
information between Alice and Bob is also reduced to Iab — § log 2 3 — 1 w 0.189. 

Thus far, we have improved Wojcik's eavesdropping scheme by constructing a new set of attack 
operations. We can see that the improved scheme is almost the same as Wojcik's eavesdropping 
scheme except for the eavesdropping-induced channel loss. Hence, all the discussions in Ref.[25] 
except for those related to the eavesdropping-induced channel loss are also suitable for the present 
paper and we will not repeat them. Now let us discuss a very important property related to the 
eavesdropping-induced channel loss. In the improved scheme the r\ domain in which Eve can attack 
all the transmitted bits is enlarged to [0, 100%] from [0, 50%] in Ref.[25]. In the ij domain of (50%, 
100%], the eavesdropping information gain does not decrease in the improved scheme but it does 
decrease in Wojcik's eavesdropping scheme. Thus, in this sense, we can say that the present zero 
eavesdropping-induced channel loss does induce more eavesdropping information gain. Hence, the 
ping-pong protocol in its original version is insecure and can be completely eavesdropped, even in 
an ideal channel. Although in [22] the security proof against eavesdropping is provided, we think, 
it is essentially not a general proof but only the result of a special choice of the ancilla. Our present 
eavesdropping scheme employing two ancillas from Wojcik instead of one ancilla in [22] has shown 
the insecurity of ping-pong protocol. 

In summary, we have improved Wojcik's eavesdropping scheme on the Bostrom-Felbinger quan- 
tum communication protocol. The improved scheme does not produce any eavesdropping-induced 
channel loss and accordingly in the whole r\ domain of [0, 100%] Eve can attack all the transmitted 
bits. Hence, in the r\ domain of (50%, 100%], the zero eavesdropping-induced channel loss does 
induce more eavesdropping information gain. Moreover, as for as the original ping-pong proto- 
col is concerned, it is insecure and can be completely eavesdropped, even in an ideal channel, for 
the eavesdropping information gain can always exceed the legitimate user's information gain. As 
mentioned by W6jcik[25], the ping-pong protocol can be made secure against his attack scheme 
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by a modification. His improvement of the ping-pong protocol security is also suitable for our 
eavesdropping attack. Actually there is a significant chance of finding an additional photon in the 
travel mode in our attack, which can then be used as an indicator for Eve's presence. The present 
eavesdropping scheme introduces a qubit error rate at the same level of 25% as one for Wojcik's 
attack scheme. If the channel has itself a QBER significantly lower than 25%, and if Alice and 
Bob sacrifice some of their message bits to perform message authentification, the qubit error rate 
induced by the attack can be used to detect the eavesdropper. Furthermore, another improvement 
of the ping-pong protocol is that, if both Alice and Bob use the generally used two- measuring-basis 
method [23] in the control mode, our present eavesdropping attack can also be detected with 25% 
possibility. 
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